Open-xchange Open-xchange_appsuite_frontend
8 CVEs affecting Open-xchange Open-xchange_appsuite_frontend. Latest disclosed: 2024-05-14. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4367 | High | 8.8 | 2024-05-14 | A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Fire… |
CVE-2016-6846 | Medium | 6.1 | 2017-03-29 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite… |
CVE-2023-26450 | Medium | 5.4 | 2023-08-02 | The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victi… |
CVE-2023-26449 | Medium | 5.4 | 2023-08-02 | The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victim… |
CVE-2023-26448 | Medium | 5.4 | 2023-08-02 | Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be execute… |
CVE-2023-26447 | Medium | 5.4 | 2023-08-02 | The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before be… |
CVE-2023-26446 | Medium | 5.4 | 2023-08-02 | The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims… |
CVE-2023-26445 | Medium | 5.4 | 2023-08-02 | Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script cod… |